Best AI Agent Security Software for Google ADK
Try it live
Watch Agentshield block an attack in real time.
Pick a scenario and drive the inspection lane yourself. No signup needed.
Run a request
Runs the live engine on your text. Nothing is stored, no account needed.
Inspection lane
INSPECTINGPolicy trace
High-risk action held for approval
Audit trail
- § · → → →
For a single Google ADK agent owned by one team, the best AI agent security software is ADK itself: a before-tool callback, the Model Armor plugin, and tool confirmation on every tool that writes. You need a separate product only when one policy has to cover several agents or frameworks, when human approvals must work on a durable session service, or when an auditor asks what each agent was allowed to do.
That is an odd way for a vendor to open a buyer guide. It is also true, and if you are in the first group you can stop reading here and go write the callback.
Why teams on Google ADK are shopping for security now
Two things happened this year. ADK 2.0 went GA for Python on May 19, 2026, for Go on June 30 and for TypeScript on August 21, replacing the old agent executor with a graph-based Workflow Runtime. Google's migration notes say custom overrides of methods such as _run_async_impl() are "completely" bypassed by the new engine and that such calls "are silently ignored". If a team put an authorization check in one of those overrides, the upgrade removed it without an error.
At the same time, ADK agents moved from demos into workflows that issue credits, update CRM records and send email on a customer's behalf. That is the point at which a security review stops asking "is the model safe" and starts asking "who approved that action". We cover the upgrade risks line by line on our Google ADK security page. This article is the buying half: what to use, and when.
What Google ADK already gives you
Before comparing products, count what you already have. Google's safety guide is candid and the primitives are good.
| Built-in control | What it does | Where it stops |
|---|---|---|
| Before-tool callback | Sees the agent state, the requested tool and its parameters, and can block the call | Only covers agents where somebody registered it |
| Security plugins | Configured once, applied "to every agent that uses the runner" | One runner at a time |
| Gemini as a judge | Sample plugin using Gemini Flash Lite to screen inputs, tool traffic and responses | Probabilistic, and costs a model call per check |
| Model Armor plugin | Screens prompts and responses for injection, jailbreaks and sensitive data | Judges text, not whether a specific action should happen |
| Tool confirmation | Pauses a tool for a human yes or no, from Python ADK 1.14.0 | Opt-in per tool. DatabaseSessionService and VertexAiSessionService are listed as "not supported by this feature" |
| VPC Service Controls | Keeps API calls inside a perimeter | Google: "Identity and perimeters only provide coarse controls around agent actions" |
Two rows in that table are why most teams end up looking at something else. The first is tool confirmation: the two session services a production team reaches for are the two the feature does not support. The second is scope: every control above lives inside one application or one runner, so five agents means five configurations that drift apart over time.
The six options, compared honestly
These are the realistic choices for a US team running ADK agents in production. Two of them cost nothing in license fees, and we would recommend them before ourselves in the right situation.
| Option | What it is | Best for | Main tradeoff |
|---|---|---|---|
| ADK callbacks and plugins | The framework's own hooks, written by your team | One agent, one team, read-mostly tools | Coverage depends on every service registering them, and the logic lives in each codebase |
| Model Armor and Gemini Enterprise Agent Platform controls | Google's content screening plus Agent Identity and IAM access policies | Teams fully on Google Cloud with one security owner | Strong on content and identity, not a per-action business policy engine |
| Google's zero-trust reference design | Open-source pattern from August 2026: per-agent signing keys, gVisor sandboxing, deterministic validation | Engineering-led teams that want to build and own the control | A reference implementation, so you build, run and patch it |
| Microsoft Agent Governance Toolkit | MIT licensed policy engine that integrates with Google ADK and other frameworks | Teams that want one open-source policy layer across frameworks | Self-hosted only, so your team is on call for a component in the path of every action |
| NVIDIA NeMo Guardrails | Open-source toolkit for programmable guardrails on LLM conversations | Conversational agents where topic and dialog control matter most | Centered on the conversation rather than tool permissions and approvals |
| A managed control plane such as Agentshield | One policy point outside the application for tool permissions, approvals, injection screening and audit | Several agents or frameworks, durable approvals, audit evidence | A paid product and one more service in the request path |
If you are weighing the open-source route seriously, we wrote a separate comparison of Agent Governance Toolkit alternatives that goes deeper on the build-versus-buy math. The short version: the toolkit is good and free, and the real cost is the on-call rotation.
How to choose AI agent security software for Google ADK
Skip the feature grids and answer four questions. They sort almost every team we talk to.
How many agents, and on how many frameworks? One ADK agent is a callback problem. Six agents across ADK, LangGraph and a vendor copilot is a policy problem, because the same rule has to hold everywhere and nobody wants to re-implement it six times.
Where do your sessions live? If the answer is VertexAiSessionService or DatabaseSessionService and any tool needs human sign-off, check how that approval is actually enforced today. Durable approval gates for AI agents need a named approver, an expiry and a record, and none of that should depend on which session backend you picked.
Who will ask for evidence? Traces answer "what did the agent do". An auditor usually asks "what was it allowed to do, and who approved the exception". If a SOC 2 or customer security review is on the calendar, the second answer has to exist before the review, not after.
Who runs it at 2 a.m.? Anything in the path of every tool call becomes a production dependency. If your team has the appetite to operate it, the open-source options are real. If not, that is the honest reason to buy. Some teams skip the question entirely and have a specialist build and operate the agent for them, which moves the on-call burden along with the build.
Does Google ADK need a separate security product?
Usually not at first. A single ADK agent with a before-tool callback, the Model Armor plugin and confirmation on its write tools is well protected. A separate control point earns its cost when one policy must span several agents or frameworks, when approvals have to survive restarts on a durable session service, or when someone external will ask what each agent was permitted to do.
Is Model Armor enough to secure Google ADK agents?
It is enough for content risk and not enough for action risk. Model Armor screens prompts and responses for injection, jailbreaks and sensitive data, and Google ships an ADK plugin for it. It does not decide whether a particular refund, delete or outbound email should happen, which is the decision that causes real incidents. Pair it with tool-level permissions.
What does ADK 2.0 change for agent security?
It changes where your checks have to live. ADK 2.0's graph engine bypasses custom overrides of 1.x methods such as _run_async_impl() and generate_content(), and Google recommends BeforeAgentCallback and AfterAgentCallback instead. Google also warns that catching BaseException traps the interrupt used for human-in-the-loop pauses. Audit both before upgrading.
What does AI agent security software cost?
It ranges from zero license cost for ADK's own controls and the open-source toolkits to a subscription for managed products. The open-source options cost engineering and on-call time instead of fees. Our own plans are published on the pricing page, so you can compare real numbers without a sales call. Most enterprise vendors in this category do not publish list prices.
Where we fit
Agentshield is built for the last row of the options table: several agents, approvals that must hold in production, and a record an auditor can read. It sits outside your ADK services, applies per-agent tool and data permissions to every call, pauses high-risk actions for a named approver, screens untrusted tool output for injection before the next step acts on it, and writes every allowed and denied action to an immutable trail. It keeps working across the 1.x to 2.0 upgrade because none of it lives in the code the upgrade changes. If you are on Gemini Enterprise already, read our guide to AI agent security software for Gemini Enterprise first, since some of what you need may already be included.
See the firewall block an attack live.
Drive the Threat Console and watch a real prompt injection get stopped, then put Agentshield in front of your own agents.